Struct Binary

pub struct Binary { /* private fields */ }

Implementations

impl Binary

pub fn parse<P: AsRef<Path>>(path: P) -> Option<Self>

Parse from a file path given as a string

pub fn header(&self) -> Header<'_>

The COFF header

pub fn sections(&self) -> Sections<'_>

Iterator over the different sections located in this COFF binary

pub fn section_by_name(&self, name: &str) -> Option<Section<'_>>

Find the section matching the given name.

Section names that do not fit in the 8 bytes allocated by the COFF format are stored in the COFF string table while the section itself only holds a /<offset> placeholder. This function transparently resolves both forms, so a long name can be looked up with its regular value:

let section = binary.section_by_name(".debug_rnglists").unwrap();
assert_eq!(section.name(), "/18");
assert_eq!(section.coff_string().unwrap().str(), ".debug_rnglists");

pub fn relocations(&self) -> Relocations<'_>

Iterator over all the relocations used by this COFF binary

pub fn symbols(&self) -> Symbols<'_>

Iterator over the COFF’s symbols

pub fn functions(&self) -> Functions<'_>

Iterator over the functions implemented in this COFF

pub fn string_table(&self) -> Strings<'_>

Iterator over the COFF’s strings

pub fn find_string(&self, offset: u32) -> Option<String<'_>>

Try to find the COFF string at the given offset in the COFF string table.

This offset must include the first 4 bytes holding the size of the table. Hence, the first string starts a the offset 4.

pub fn find_function(&self, name: &str) -> Option<Symbol<'_>>

Try to find the function (symbol) with the given name

pub fn find_demangled_function(&self, name: &str) -> Option<Symbol<'_>>

Try to find the function (symbol) with the given demangled name

pub fn disassemble_slice( &self, slice: &[u8], address: u64, ) -> InstructionsIt<'_>

Disassemble code provided by the given slice at the specified address parameter.

See also crate::assembly::Instruction and crate::assembly::Instructions

pub fn disassemble_function(&self, name: &str) -> InstructionsIt<'_>

Disassemble code for the given function name

let insts = binary.disassemble_function("int __cdecl bar(int, int)");
for inst in insts {
    println!("{}", inst.to_string());
}

See also crate::assembly::Instruction and crate::assembly::Instructions

pub fn disassemble_symbol(&self, symbol: &Symbol<'_>) -> InstructionsIt<'_>

Disassemble code for the given symbol

let symbol = binary.find_demangled_function("int __cdecl bar(int, int)").unwrap();
let insts = binary.disassemble_symbol(&symbol);
for inst in insts {
    println!("{}", inst.to_string());
}

See also crate::assembly::Instruction and crate::assembly::Instructions

Trait Implementations

impl Debug for Binary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Binary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.